Skip to main content

DevSecOps Engineer path

For engineers who secure the path from a commit to a running pod. The path builds each control the way the tool that enforces it works: Linux capabilities and seccomp, RBAC and admission, a secrets service with leases, runtime detection over system calls, NetworkPolicy, secret scanning, SPIFFE workload identity, CVE prioritisation and a CIS benchmark, plus the supply chain in between (workflow security, OIDC, SBOMs, signing) and cloud IAM.

Lessons appear here as they are published; prerequisites are listed on each lesson page.

DevSecOps Engineer · 42 lessons · 60.3 h
  1. Build The Lab: One Command That Proves Your Machine Is Ready · Phase 00 Setup & Lab · 60 min
  2. Build PID 1: Why Your Container Ignores Ctrl-C · Phase 01 Linux & Systems · 75 min
  3. Build File Descriptors: Too Many Open Files Is a Leak, Not a Limit · Phase 01 Linux & Systems · 75 min
  4. Build Every Error Message Is a System Call That Failed · Phase 01 Linux & Systems · 75 min
  5. Build Root Is a Bundle of 41 Bits: Permissions and Capabilities · Phase 01 Linux & Systems · 75 min
  6. Build A Path Is a Lookup Through a Mount Table · Phase 01 Linux & Systems · 75 min
  7. Build A Route Is a Longest-Prefix Match Plus a Rule Table · Phase 02 Networking · 75 min
  8. Build Most Network Outages Are Timeouts You Did Not Set · Phase 02 Networking · 90 min
  9. Build TLS Is a Handshake and a Chain You Can Verify · Phase 02 Networking · 120 min
  10. Build Git Is a Content-Addressed Object Store · Phase 03 Git & Collaboration · 90 min
  11. Build Hooks Are Programs Git Runs at the Right Moment · Phase 03 Git & Collaboration · 75 min
  12. Build A Bash Script Is Only Safe With Strict Mode and Quotes · Phase 04 Scripting & Automation · 75 min
  13. Build Process Isolation: A Container Is Just a Process · Phase 05 Containers · 90 min
  14. Learn Images Are Just Layers · Phase 05 Containers · 45 min
  15. Build Pull an Image With Plain HTTP: Registries Are Content-Addressed · Phase 05 Containers · 75 min
  16. Build Build an Image Without a Dockerfile: Layers, Config and Manifest by Hand · Phase 05 Containers · 90 min
  17. Build A Container's Network Is a veth Pair, a Bridge and Three NAT Rules · Phase 05 Containers · 90 min
  18. Build Compose Is a Dependency Graph Over docker run · Phase 05 Containers · 90 min
  19. Build Shrink What a Compromised Process Can Do: seccomp, Capabilities, Read-Only Roots · Phase 05 Containers · 90 min
  20. Build A Controller Is a Loop That Compares: Reconcilers From Scratch · Phase 06 Orchestration · 90 min
  21. Build A Scheduler Is Filter, Score, Bind · Phase 06 Orchestration · 90 min
  22. Build A Node Agent Turns a Pod Spec Into Processes · Phase 06 Orchestration · 90 min
  23. Build A Service Is a Virtual IP and a Rewrite Rule · Phase 06 Orchestration · 90 min
  24. Build kubectl auth can-i Is a Function You Can Write · Phase 06 Orchestration · 75 min
  25. Build Plan and Apply: A State File Is Just a Diff · Phase 07 Infrastructure as Code · 90 min
  26. Build Apply Order Is a Graph Walk · Phase 07 Infrastructure as Code · 90 min
  27. Build A Pipeline Is a Graph of Jobs in Clean Rooms · Phase 08 CI/CD & GitOps · 90 min
  28. Build A Workflow Is Code That Holds Your Secrets · Phase 08 CI/CD & GitOps · 90 min
  29. Build Short-Lived Credentials: OIDC From CI to the Cloud · Phase 08 CI/CD & GitOps · 90 min
  30. Build An SBOM Is an Inventory You Can Diff · Phase 08 CI/CD & GitOps · 75 min
  31. Build Signing Is a Hash, a Key and a Public Log · Phase 08 CI/CD & GitOps · 120 min
  32. Build Every AWS API Call Is a Policy Evaluation · Phase 09 Cloud Providers · 90 min
  33. Build A VPC Is Route Tables and Rules You Can Evaluate · Phase 09 Cloud Providers · 90 min
  34. Build Secure Defaults Are Checks You Can Run · Phase 09 Cloud Providers · 90 min
  35. Build A Secret Is a Lease, Not a String · Phase 11 Security & DevSecOps · 120 min
  36. Build Admission Control Is a Webhook That Can Say No · Phase 11 Security & DevSecOps · 90 min
  37. Build Runtime Detection Is a Rule Engine Over System Calls · Phase 11 Security & DevSecOps · 90 min
  38. Build A NetworkPolicy Is a Default Deny You Have to Write · Phase 11 Security & DevSecOps · 90 min
  39. Build A Leaked Key Is a Pattern, Entropy and History · Phase 11 Security & DevSecOps · 75 min
  40. Build Zero Trust Is Mutual TLS With Short-Lived Identities · Phase 11 Security & DevSecOps · 120 min
  41. Build A CVE Is a Question: Reachable, Exploited, Exposed? · Phase 11 Security & DevSecOps · 75 min
  42. Build A Benchmark Is a List of Checks You Can Automate · Phase 11 Security & DevSecOps · 75 min

Pair this with the Cloud Security / DevSecOps career page, the DevSecOps guides and Cloud Security in the Reference layer.